Hong Kong’s business risk landscape is evolving, with rising cybersecurity, privacy, and AI-related risks adding to longstanding concerns over workplace conditions and compliance. 

Hong Kong moved early on sustainability disclosure in Asia. Under the government’s roadmap,¹ large publicly accountable entities are expected to fully adopt International Sustainability Standards Board (ISSB)-aligned standards by 2028. Mandatory climate disclosures are also being phased in for listed issuers. As these requirements expand, companies need consistent, defensible due diligence across business conduct, sustainability, regulatory, and reputational risks.

# Country-level numbers tell only part of Hong Kong’s risk story

Hong Kong is a regional business hub with internationally exposed companies. In 2025, it recorded fewer risk incidents per USD 100 billion of GDP than the Philippines, Malaysia, and Thailand, but more than Taiwan, Vietnam, and China. The GDP-adjusted comparison offers a useful starting point for understanding Hong Kong’s position relative to other regional markets.

# Recorded risk incident rates vary widely across regional markets

Fig 1. Risk incidents linked to each country per USD 100 billion of GDP, 2025.²

To understand what lies behind these country-level differences, it helps to look beyond incident counts. RepRisk’s analysis links reported incidents to specific sectors and issues, while tracking how risk patterns evolve over time and shift across sectors and jurisdictions. This helps distinguish recurring areas of concern from isolated events and gives organizations a clearer basis for deciding which counterparties warrant closer scrutiny. 

Between 2020 and 2025, the largest absolute increases in recorded business conduct risk incident-sector linkages were in Construction and Materials, Retail, Travel and Leisure, Financial Services, and Food and Beverage. Financial Services saw the largest single-year increase, with 41 additional linkages from 2023 to 2024. Most recently, Construction and Materials recorded the sharpest rise, adding 39 incidents from 2024 to 2025.  

# Risk incidents rise sharply in Financial Services and Construction

Fig 2. Annual incident–sector linkages for Hong Kong’s five highest-volume sectors, 2020–2025.³

Looking at the business conduct issues associated with reported incidents, the largest absolute increases between 2020 and 2025 were in poor employment conditions, occupational health and safety, product-related concerns, fraud, and violations of national legislation.

# Incident trends span compliance, fraud, safety, and product issues

Fig 3. Annual incident–issue linkages for Hong Kong’s five highest-volume issues, 2020–2025.⁴

Other fast-growing issues include controversial products and services, community impacts, and supply chain issues. Poor employment conditions saw the largest percentage increase, with incident-issue linkages rising 1,875% between 2020 and 2025.

# Cybersecurity and privacy risks are becoming more visible

Cybersecurity and privacy remain a relatively small part of Hong Kong’s recorded business conduct risk profile, but related risk signals are growing. Hong Kong’s first comprehensive cybersecurity law, The Protection of Critical Infrastructures (Computer Systems) Ordinance,⁵ took effect in January 2026. It sets requirements for designated critical infrastructure operators on system security, prevention, incident reporting, and response.

From September 2021 to August 2026, linkages to Privacy violations rose by 117%, while linkages to Cyberattacks rose by 250%. Across the period, they accounted for 9.6% and 4.5% of all Topic Tag linkages⁶ associated with Hong Kong risk incidents, respectively.

# Cybersecurity-related concerns are among the top five Topic Tag linkages in Hong Kong

Fig 4. Hong Kong’s five most prominent Topic Tags by share of all Topic Tag linkages, September 2021-August 2026.⁷

# AI-related risk signals are growing from a small base

AI is another emerging business conduct risk area. RepRisk introduced a dedicated Artificial Intelligence Topic Tag in 2024, and linkages increased by 200% in 2025. By August 2026, AI accounted for 1.8% of all Topic Tags associated with Hong Kong risk incidents over the prior 12 months.

Technology-related risk incidents can also point to problems beyond the immediate issue: a risk incident involving an AI-enabled product or service may also raise questions about data privacy, cybersecurity, product responsibility, or regulatory compliance.

# Effective due diligence connects the dots between risks

For organizations with exposure to Hong Kong, business conduct risks rarely sit in isolation. Workplace conditions, product concerns, cybersecurity, privacy, and emerging AI-related risks can overlap, creating broader regulatory, operational, and reputational exposure.

A connected view of these risks, across companies, sectors, and over time, helps identify where closer scrutiny is needed and supports more focused due diligence.

---

Copyright 2026 RepRisk AG. All rights reserved. RepRisk AG owns all intellectual property rights to this report. This information herein is given in summary form and RepRisk AG and/or the third party contributors to this report make no representation or warranty that any data or information supplied to or by it or them is complete or free from errors, omissions, or defects. Without limiting the foregoing, in no event shall RepRisk AG and/or the third party contributors to this report have any liability (whether in negligence or otherwise) to any person in connection with the information contained herein. Any reference to or distribution of this report must include a link to the content to provide sufficient context. The information provided in this presentation does not constitute an offer or quote for our services or a recommendation regarding any investment or other business decision, and is not intended to constitute or to be used as a substitute for legal, tax, accounting, or other professional advice. Please note that the information may have become outdated since its publication. Should you wish to obtain a quote for our services, please contact us.

Decision‑grade means suitable for identifying and prioritizing risk exposure as an input into a broader decision‑making process. RepRisk data does not determine legality, compliance, thresholds, or required actions, and does not prescribe investment, procurement, or engagement decisions.